CSC 386 – Computer Security Scott Heggen

Agenda Authentication Passwords Reducing the probability of a password being guessed Reducing the probability of someone learning your password from the user Reducing the probability of someone learning your password from the system

What About the System? Where are usernames and passwords stored? An attacker could try to compromise the confidentiality or integrity of this file Countermeasures: cryptographic protection, access control enforced by the operating system, combination of cryptographic protection and access control, possibly with further measures to slow down dictionary attacks.

One-way Functions For cryptographic protection we can use one-way functions (cryptographic hash functions). Definition: A one-way function f is a function that is relatively easy to compute but hard to reverse. Given an input x it is easy to compute f(x), but given an output y it is hard to find x so that y = f(x) Instead of the password x, the value f(x) is stored in the password file; when a user logs in entering a password x’, the system applies the one-way function f and compares f(x’) with the expected value f(x).

Peruvian Coin Flip User creates a password User runs the password through some arbitrarily complex math function User shares result with system

Access Control Settings Who should be able to write to a password file? Who should be able to read from a password file?

Caching When navigating through a website, why don’t you need to log in on every page load? Passwords are sometimes stored locally to retain a “session” This password can remain in the cache for long periods of time

Single Sign-on At Berea, how many systems do you sign into? How many username/password combinations do you have for all these systems? What’s wrong with this “feature”?

Other Forms of Authentication What other ways can we authenticate a user? Based on: Something you know Something you have Something you are

Something You Know The user has to know some secret to be authenticated. Examples: password, personal identification number (PIN), personal information like home address, date of birth, name of spouse (used e.g. by banks to authenticate customers on the phone). Anybody who obtains your secret “is you”. You leave no trace if you pass your secret to somebody else. There is a case of computer misuse where somebody has logged in using your username and password. Can you prove your innocence? Can you prove that you have not divulged your password?

Something You Have User presents a physical token to be authenticated. Examples: keys, cards or identity tags (access to buildings), smart cards. Physical tokens can be lost or stolen. Anybody who is in possession of the token has the same rights as the legitimate owner. To increase security, physical tokens are often used in combination with something you know, e.g. bank cards come with a PIN or with a photo of the user.

Something You Are Biometric schemes use unique physical characteristics (traits, features) of a person such as face, finger prints, iris patterns, hand geometry (maybe even DNA at some time in the future). Biometrics may seem to offer the most secure solution for authenticating a person. Biometric schemes are still quite new; it has to be seen whether results from experiments conducted in controlled environments are a good indicator for practical performance.

Failure Rates New issue: false positives and false negatives Accept wrong user (false positive): security problem. Reject legitimate user (false negative): creates embarrassment and an inefficient work environment.

Technology Analysis Based on a (given) databases of biometric samples. Measures performance of the algorithms extracting and comparing biometric features. False match rate (FMR): False non-match rate (FNMR):

Finding the Right Balance FMRFNMR 01Matching Threshold (in %) EER 0% 10% 20% 30% (Equal error rate)

New Stuff in Authentication Two-factor Gesture Authentication Picture-Gesture Authentication Keystroke Cops Voice RFID Tags

Summary Authentication is not about guaranteeing a person’s identity is correct Authentication is about maximizing the probability that a person’s identity is correct …or alternatively, minimizing the probability that a person’s identity is forged Must balance the probability that a failure allows wrongful access against the probability that a failure denies rightful access